no_fs is a simple way to take away all FS access, without constructing path_policies etc. no_new_fd disallows opening any new file descriptors